Category: Uncategorized

In a short period of just over 4 weeks the Irish Government and the Commission for the Regulation of Utilities (CRU) have sought to navigate the delicate balance between facilitating the development of the digital economy in Ireland, achieving energy infrastructure resilience and promoting positive climate change by publishing 2 key policy documents. The Large Energy User Action Plan (LEAP) and the Large Energy Users (LEUs) Connection Policy have come as a much-needed strategic relaxation of the 4 year moratorium on the development of data centres, particularly in the Greater Dublin Region.

Key takeaways from the LEAP and updated LEU Connection Policies

• Renewable Power: Large Data Centre seeking connection must commit to placing themselves on a glide path to achieve 80% of utilised power from a renewable source within 6 years;
• Private Wire: The Government is to legislate for private actors to install private electricity infrastructure;
• Green Energy Parks/Plan-led Model: System Operators and the CRU will facilitate plan-led demand locations, pre-determining where LEUs can locate through the establishment of green energy parks with the co-location of energy generation and/or storage onsite with the LEUs and
• Electricity Infrastructure Investment and Delivery: EirGrid, ESB Networks, the Department of Climate, Energy and the Environment (DCEE), and the Commission for Regulation of Utilities (CRU) are tasked with progressing investment in electricity infrastructure in line with Ireland’s 80% renewable energy target.

Access the full article – LEAP Forward in Clarity for Ireland’s Data Centre Sector and Large Energy Users

See more articles from our Irish member firm Byrne Wallace Shields.

Consumer reviews can make or break a purchase. For any trader that displays them, how those reviews are sourced, verified, and presented matters – because fabricated, selectively presented, or unverified reviews can distort consumer choice and mislead consumers.

The latest analysis outlines Bulgaria’s legal framework on consumer reviews, examines the enforcement approach of the Bulgarian Consumer Protection Commission to date, and highlights the key consequences for non-compliance.

Access the full article – Fake Consumer Reviews

See more articles from our member firm in Bulgaria, Boyanov & Co.

Bulgaria has now implemented NIS 2, significantly expanding the scope of regulated entities and introducing strict cybersecurity risk management and incident reporting obligations. For many medium-sized and larger businesses, this marks the first time cybersecurity becomes a direct regulatory and governance responsibility.

Businesses operating in the affected sectors should promptly assess whether they fall within scope and whether existing controls meet the new standard.

Read more on this here.

See more articles from our member firm in Bulgaria, Boyanov & Co.

Entrepreneurs in the EU benefit from access to the European Single Market. Yet in practice, those operating across several Member States face 27 different legal and administrative realities.

In this fragmented landscape, a striking new initiative is gaining momentum: EU-Inc, a proposal for a pan-European legal entity with one uniform structure and one regulatory framework, regardless of the Member State of incorporation.

With this envisioned “28th regime,” a growing coalition of private sector stakeholders and European policymakers hopes to reposition the EU as an attractive ecosystem for innovative startups and international investors.

And for those ready to take the next step in European integration, the EU-Inc petition is open for signatures.

OBSTACLES TO EUROPEAN COMPETITIVENESS

The Draghi Report of September 2024 confirmed what startups and investors have long experienced: the EU is losing ground as a competitive economic power. Europe struggles with an overgrowth of regulation, a fragmented market and limited access to venture capital. These issues result in substantial administrative and compliance costs, hampering business development and growth. A pan-European corporate entity – akin to a Delaware LLC – could help address these barriers.

The call for a European legal entity to facilitate cross-border business operations is not new. In 2004, the Societas Europaea (SE) was introduced as a flexible vehicle for cross-border integration. Yet, due to a lack of political consensus and ambition, the SE never became the supranational entity initially envisioned. Only a small number of SEs were ever created, largely due to complexity, high implementation costs and limited practical advantages.

The European Commission subsequently attempted to launch two more effective alternatives: the European Private Company (EPC) in 2010 and the Single-Member Company (SMC) in 2014. Both proposals ultimately suffered a political demise as Member States disagreed over key issues such as taxation, governance and employee participation.

Meanwhile, a growing consensus holds that the EU can no longer stand by while European talent and capital migrate elsewhere and countries like the US and China continue to produce one tech unicorn and hyperscaler after another.

WHAT IS EU-INC?

EU-Inc is an industry-driven proposal for a new pan-European legal entity established under and governed by a uniform 28^th corporate regime, operating alongside – or rather above – the 27 national frameworks. The initiative is championed by a broad coalition of European private sector stakeholders, investors, academics and legal experts advocating for a digital, streamlined and uniform corporate environment within the EU.

To achieve this, EU-Inc would allow companies to incorporate a private, share-based limited liability company digitally, swiftly and without notarial intervention. By subjecting this legal entity to a single, uniform governance framework, EU-Inc aims to make it easier for startups to attract talent and capital from across Europe.

This bottom-up initiative has been elaborated in a detailed policy note (the EU-Inc Policy Proposal), which will ultimately be submitted to the European Commission for consideration.

INNOVATIONS FOR EUROPEAN ENTREPRENEURS

EU-Inc introduces four pillars that together aim to provide a uniform, digital and scalable corporate framework within the EU.

The first pillar establishes the legal foundation for a harmonised corporate structure with a strong digital-first approach. It proposes several innovations: a unified limited-liability corporate form (EU-Inc), a standardised governance model (Core Corporate Framework), as well as a centralised digital register (EU-REGISTRY) and management interface (EU-DASHBOARD). Early-stage funding should also become faster and more accessible through EU-FAST (Fast Advanced Subscription Template), a European counterpart to the US SAFE convertible instruments.

With EU-ESOP (Employee Share Option Plan), the second pillar aims to create a harmonised European framework for share option scheme for employees, enabling startups to attract and retain talent across borders.

Pillars three and four address taxation and employment law. Although these areas remain subject to the Member State’s legislation, EU-Inc advocates for maximum alignment and coherence to better support fluent cross-border business integration within the Single Market.

CHALLENGES AHEAD

EU-Inc responds to a critical need: the structural competitiveness problems identified in the 2024 Draghi Report.

Yet, its political feasibility remains uncertain. To be directly applicable in all Member States, the 28th regime would have to be implemented through an EU regulation – a step that entails a significant shift in the balance of powers from Member States towards Brussels. The proposal also has important implications for the current competition and economic dynamics between Member States.

While interest from businesses and investors is rising rapidly, the initiative faces the familiar legal, political and institutional challenges that characterise the EU. At the same time, the European Commission’s recent EU Startup & Scaleup Strategy creates favourable momentum for EU-Inc.

The coming years will show whether EU-Inc becomes the real next step in completing the Single Market – or whether it remains, for now, an ambitious idea that seems too good to be true.

See more articles from our member firm in Belgium, Philippe & Partners.

Digital nomads can now legally live in Bulgaria on a long-term basis. The new Digital Nomad Residence Permit allows remote workers to stay for one year, with the option to extend for another year. This is a significant change from the previous short-term stay limits.

With Sofia gaining recognition as an emerging digital nomad hub, these changes position Bulgaria as an attractive new base for global remote talent.

Access the full article – Bulgaria Launches a Digital Nomad Residence Permit

See more articles from our member firm in Bulgaria, Boyanov & Co.

The CJEU judgment of 4 September 2025 clarifies the scope of the concept of “personal data.” The Court held that information relates to an individual where it is linked to a data subject by its content, purpose, or effect. It also acknowledged that pseudonymised data may not constitute personal data for a recipient who is not in a position to identify the data subjects. Finally, the CJEU reiterated that the obligation to provide information applies to the data controller when individuals are identifiable, but not to a third party who is unable to identify them.

In its judgment of 4 September 2025 (Case C-413/23 P), the Court of Justice of the European Union (CJEU) provided important clarifications regarding the scope of the notion of “personal data” within the meaning of Regulation (EU) 2018/1725—that is, the regulation analogous to the GDPR, governing the protection of natural persons with regard to the processing of personal data by the EU institutions, bodies, offices, and agencies.

The Facts

The case concerns a Spanish bank that underwent a restructuring process. For that purpose, the Single Resolution Board (SRB) sought the opinions of former shareholders and creditors. The responses submitted anonymously were transmitted to an external company for analysis. However, it appeared that the individuals who had provided their opinions had not been informed by the SRB of this use of their data and of the disclosure of their responses to third parties.

The Procedure

Some of the data subjects lodged a complaint with the European Data Protection Supervisor (EDPS), who found that the SRB had failed to comply with its information obligations under Regulation (EU) 2018/1725. The SRB challenged this finding before the General Court, which overturned the EDPS’s decision. The EDPS subsequently lodged an appeal before the Court of Justice of the European Union (CJEU).

The CJEU’s Decision: Three Key lessons

More than six years after the entry into application of the GDPR, the CJEU issued a notable judgment clarifying the concept of “personal data”.

• First, the CJEU held that information “relates to” a data subject if it is linked to that person by one of three criteria: its content, its purpose, or its effect. Given the “particular nature of personal opinions or views which, as an expression of a person’s thinking, are necessarily closely linked to that person” (the content criterion), the Court found that it was not necessary, in this case, to examine the other criteria to conclude that the comments in question are personal data.
• Second, while it was generally accepted that pseudonymised data remains personal data in all circumstances, the CJEU refined this assumption. The Court thereby recognises a conceptual distinction according to which, although the initial data controller is still able to re-identify the data subjects, if the recipient does not have this ability, the data are not, from the recipient’s point of view, personal data.
• Third, regarding the SRB’s obligation to inform the data subjects of the transfer of their pseudonymised data to a third party, the CJEU emphasised that this obligation must be assessed within the relationship between the SRB and the data subjects, that is prior to any disclosure to a third party. Since, at that stage, the data subjects were identifiable, the SRB was required to comply with its information obligation. On the other hand, a third party who does not have reasonable means of identifying the data subjects is not subject to such an obligation.

This judgment is therefore significant because it clarifies the notion of personal data and acknowledges that pseudonymised data may, in certain circumstances, not be concerned the scope of the GDPR.

See more articles from our member firm in Belgium, Philippe & Partners.

For the first time, an agreement between the EU and the US on the transfer of personal data has withstood judicial scrutiny by the European courts. The judgment in Latombe v. European Commission (General Court of the European Union, 3 September 2025) confirms that the EU–US Data Privacy Framework (DPF) ensures an adequate level of protection, as required under the EU’s General Data Protection Regulation (GDPR).

With the safeguards now in place under US law, European companies can continue to use American cloud and IT services with greater peace of mind. Or should caution still prevail?

Transfer of personal data between the EU and the US

Since 2018, the GDPR has aimed to guarantee a high and uniform level of data protection within the European Economic Area (EEA). However, many companies operate outside this area or do business with entities established abroad, resulting in the processing of personal data outside the EEA.

Such transfers are in principle only permitted where adequate data protection can be ensured through one of the mechanisms provided for under the GDPR. An adequacy decision adopted by the European Commission, declaring that a non-EEA country ensures an adequate level of protection, is one such mechanism.

Given their shared commercial interests, the EU and the United States have long sought to establish a regulatory framework that meets the stringent requirements of the GDPR. Yet repeated surveillance scandals and the lack of independent oversight in the US have proven major stumbling blocks.

The 2000 Safe Harbour Agreement was invalidated by the Court of Justice in its Schrems I judgment (2015), and the 2016 Privacy Shield met the same fate in its Schrems II judgment (2020). In both cases, the Court found that US intelligence services had overly broad powers and that EU citizens lacked sufficient judicial redress against disproportionate interference.

Following these rulings, negotiations resumed with the US to create a new framework that would comply with both the GDPR and the EU Charter of Fundamental Rights. This led to Commission Implementing Decision (EU) 2023/1795, which endorsed the EU–US Data Privacy Framework — a self-certification system under which US companies that have self-certified under the DPF must comply with the principles, rules and obligations governing the processing of personal data of individuals in the EEA.

The framework introduces new safeguards for the processing of personal data by US intelligence authorities and establishes the Data Protection Review Court (DPRC).

The case Latombe v. European Commission

Shortly after the DPF entered into force, French Member of the European Parliament Philippe Latombe brought an action before the General Court seeking annulment of the adequacy decision. He argued that the European Commission had exceeded its margin of discretion by determining that the United States ensured an adequate level of protection.

Latombe maintained that, even with the new guarantees introduced, the US legal system still failed to provide sufficient safeguards for key GDPR requirements — in particular with respect to (1) effective judicial redress, (2) interference by intelligence services, (3) automated decision-making, and (4) security of processing of personal data.

He further claimed that, in assessing the DPF, the Commission had failed to take adequate account of the Schrems I and Schrems II case-law, and that the new framework still suffered from essentially the same deficiencies.

The judgment of 3 September 2025

The General Court, however, dismissed all of Latombe’s pleas and upheld the validity of the DPF.

• Right to an effective remedy (Article 47 of the Charter)

The Court held that the DPRC is functionally independent and protected from undue influence. Although its members are appointed and removed by the executive branch, they enjoy sufficient safeguards. The fact that the DPRC is not part of the judiciary is acceptable, as its guarantees are equivalent and its decisions are binding and final on the US government and intelligence agencies.

• Interference by intelligence services (Articles 7 and 8 of the Charter)

Latombe argued that US law still allows for intelligence agencies to collect personal data in bulk without prior judicial or administrative authorisation. The Court rejected this argument, finding that indiscriminate or mass collection of data is not permitted in the US. Bulk collection is allowed only when targeted collection is not feasible and must be limited, necessary and proportionate, subject to subsequent review by an independent body.

• Automated decision-making (Article 22 GDPR)

Unlike the GDPR, US law does not contain a general prohibition on purely automated decision-making without human intervention. The applicable rules differ across sectors and types of organisations. Nonetheless, the Court found that the US framework provides adequate protection, as the DPF imposes transparency obligations on organisations and grants individuals the right to request human review of an automated decision. In addition, oversight mechanisms are in place to handle complaints from individuals.

• Security of processing (Article 32 GDPR)

Whereas the GDPR imposes a general obligation to ensure the security of personal data, this obligation in the US applies only to organisations that have formally adhered to the DPF. The Court found that the Commission had sufficiently assessed whether the US certification system offers adequate protection. Since certified organisations are contractually bound to implement appropriate security measures and are subject to supervision by the US authorities, the Court held that an equivalent level of protection is ensured.

The Court consistently emphasised that the US system does not need to be identical to the GDPR, provided that the level of protection is “essentially equivalent” in practice. Although the DPF currently stands, its future remains uncertain, nonetheless.

In addition to a possible appeal that Latombe may bring against this judgment, several privacy-rights organisations — including NOYB (None of Your Business), founded by Max Schrems — have already announced their intention to challenge the DPF on broader grounds through both administrative and judicial channels.

Finally, adequacy decisions such as the DPF are subject to periodic review every four years. The first review will therefore take place by 2027 at the latest. The European Commission will then need to assess whether the US continues to uphold the promised safeguards. In today’s unpredictable political climate of trade tensions and shifting policies, that remains to be seen.

See more articles from our member firm in Belgium, Philippe & Partners.

The issue of transfers of personal data outside the European Economic Area remains not only very topical, but also very sensitive. The decision handed down by the Court of Justice of the European Union on 8 January 2025 illustrates this perfectly. The case under consideration was between a German citizen and the European Commission. This case (T-354/22) questions the lawfulness of the transfers of personal data to third countries carried out by the Commission and recalls the obligation of the European institutions to guarantee a level of protection in accordance with the standards of the GDPR and Regulation 2018/1725.

1. The case in brief. Bindl, after accessing the website of the Conference on the Future of Europe, found that connections with third parties, including Amazon Web Services (AWS) and Meta Platforms Inc. (Facebook), had been activated, raising questions about possible data transfers outside the EU. In order to register for an event on this site, he used the authentication option via Facebook (EU Login), resulting in a transfer of his IP address and other information to Meta’s servers in the United States. Mr Bindl, a German citizen with a keen interest in IT and data protection issues, asked the Commission for clarification, but the Commission was slow to respond. The case concerned three points: the cancellation of the data transfers, the recognition of a failure by the Commission and a claim for compensation for moral damage.
2. Legal teaching. The General Court dismissed the applications for annulment and for recognition of a failure to act, holding that the transfers at issue did not constitute challengeable acts within the meaning of Article 263 TFEU. However, regarding the question of the Commission’s liability, the General Court held that the transfer of personal data to the United States did indeed constitute a violation of Article 46 of the GDPR, in the absence of sufficient safeguards. The General Court thus ordered the European Commission to pay Mr Bindl the sum of EUR 400 in compensation for the damage suffered.

This judgment is based on three fundamental elements:

• • The sufficiently serious breach of EU law: The Commission failed to fulfil its obligations by facilitating the transfer of data via the Facebook hyperlink without providing safeguards in accordance with the requirements of the GDPR.
  • The existence of moral damage: The uncertainty about the security of the data and the lack of transparency of the Commission placed Mr Bindl in a situation of legal uncertainty.
  • A direct causal link: The display of the Facebook hyperlink on EU Login immediately led to the transmission of the data, which was attributable to the Commission.

3. Impact and perspectives. This judgment illustrates the rigour of judicial review in data protection and highlights the legal risks associated with the use of third-party services for user authentication. It also underlines the responsibility of the European institutions in the implementation of online connection devices and the need to provide safeguards in line with the requirements of the GDPR.

This ruling sets an important precedent, especially for public entities using US services involving data transfers outside the EU. He points out that the presence of a simple hyperlink leading to an external service may be enough to engage the liability of an institution in the event of a non-compliant data transfer. It also shows that our institutions are in no way exempt from the regulations to which they themselves have given birth; Compliance and legal rigour are required, including in the upper echelons of our democratic institutions.

Transferring data outside the European Economic Area in a GDPR-compliant manner remains a challenge today. In this respect, we welcome the recent initiative of the CNIL, which has published a guide on the impact assessments of data transfers, intended to support organizations carrying out such transfers.

See more articles from our member firm in Belgium, Philippe & Partners.